Live › vulnerability › CVE-2026-119089
The ThirstyAffiliates WordPress plugin up to and including version 3.12.1 does not sanitize the comment parameter on block themes. An unauthenticated attacker can store scripts that run in the browser of any visitor who opens an affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running ThirstyAffiliates up to and including 3.12.1 on a block theme where the Comment Content block renders comments. The sources say an attacker must first have one comment approved, after which later crafted comments are auto-approved. Sites on classic themes or without the plugin are not described as affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| thirstyaffiliates | wordpress | <= 3.12.1 | 3.12.2 |
wp plugin get thirstyaffiliates --field=versionUpdate ThirstyAffiliates to 3.12.2 or later (WPSec advisory; not confirmed on maintainer page)
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.
This page as .md · .json · in your agent: get_signal("CVE-2026-119089")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.